@asidfhiodfugnsdf/hello-world-slsa

A hello world npm package with SLSA 3 provenance and trusted publishing.

Development

Prerequisites

• Node.js 20.x
• Yarn 4.x (via corepack)

Setup

corepack enable
yarn install

Scripts

yarn build    # Compile TypeScript
yarn test     # Run tests

Releasing

This package uses:

• Changesets for versioning
• SLSA 3 Node.js builder for provenance
• npm trusted publishing (OIDC) for secure tokenless releases

One-time setup

1. First publish (manual, to create the package on npm):

   npm login
   yarn build
   npm publish --access=public

2. Configure trusted publishing on npmjs.com:

   • Go to https://www.npmjs.com/package/@asidfhiodfugnsdf/hello-world-slsa/access
   • Under "Publishing access", add a trusted publisher:
     • Repository owner: sjkdh2ksjdhgj9
     • Repository name: npm-test-repo
     • Workflow filename: publish.yml

3. Enable GitHub Actions permissions:

   • Go to repo Settings → Actions → General
   • Enable "Allow GitHub Actions to create and approve pull requests"

Making a release (step by step)

1. Make your code changes and commit them

2. Create a changeset describing your changes:

   yarn changeset

   • Select the package
   • Choose version bump type (patch/minor/major)
   • Write a summary of changes
   • This creates a file in .changeset/

3. Commit and push the changeset:

   git add .changeset
   git commit -m "Add changeset for <your change>"
   git push origin main

4. Wait for the "Version Packages" PR:

   • The publish.yml workflow runs on push to main
   • It creates a PR titled "Version Packages"
   • This PR bumps the version in package.json and updates the changelog

5. Review and merge the PR:

   • Review the version bump and changelog
   • Merge the PR to main

6. Automatic publish with SLSA 3:

   • Merging triggers the workflow again
   • Changesets detects no pending changesets and runs changeset tag
   • SLSA 3 builder builds the package in an isolated environment
   • Package is published to npm with SLSA 3 provenance attestation

Verifying provenance

After publishing, verify the package provenance:

npm audit signatures

Or use the SLSA verifier:

slsa-verifier verify-npm-package @asidfhiodfugnsdf/hello-world-slsa --source-uri github.com/sjkdh2ksjdhgj9/npm-test-repo